Missing Authorization (ARCH7120)

Key php.security.missing-authorization · Severity warning · Category security · CWE CWE-862

Exposing a sensitive action without an authentication/authorization check lets any user invoke an operation that should be protected.

Incorrect

<?php
// No middleware/policy
Route::delete('/users/{id}', function ($id) {
    User::destroy($id); // anyone can delete
});

Correct

<?php
Route::delete('/users/{id}', function ($id) {
    Gate::authorize('delete-users');
    User::destroy($id);
})->middleware('auth');

Fix

Add authentication middleware and an explicit authorization check (Gate/Policy) to every state-changing endpoint.